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Three-party quantum private comparison of equality 
based on genuinely maximally entangled six-qubit 
states 
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Dongyang Long 


Abstract We propose a new three-party quantum private comparison pro¬ 
tocol using genuinely maximally entangled six-qubit states. In our protocol, 
three participants can determine whether their private information are equal 
or not without an external third party who helps compute the comparison 
result. At the same time the participants can preserve the privacy of their 
inputs, respectively. Our protocol does not need any unitary operations to 
encode information due to the excellent properties of genuinely maximally 
entangled six-qubit states. Additionally, the protocol uses one-step quantum 
transmission and it is congenitally free from Trojan horse attacks. We have 
also shown that our protocol is secure against outside and participant attacks 
in this paper. 

Keywords Three-party quantum private comparison • Genuinely maximally 
entangled six-qubit state • Trojan horse attack 


1 Introduction 

The first quantum key distribution (QKD) protocol was proposed by Ben¬ 
nett and BrassardpQ in 1984. After that, an increasing number of quantum 
cryptographic protocols such as quantum secret sharing (QSS) pOGMHElIIllS ! 
quantum secure direct communication (QSDC) [ MTUllTTirr21l 1 3II 1 4 1IT5] . quan¬ 
tum key agreement (QKA) jT6llT7lH8l[l9l . quantum summation I20ll211[22l[23l 
[24] and quantum private comparison (QPC) [2511261127] have been presented. 


C. Zhang • X. Huang • D. Long 

School of Information Science and Technology, Sun Yat-sen University, Guangzhou, Guang¬ 
dong, 510006, China 
E-mail: zhangcai.sysu@gmail.com 
Z. Sun 

College of Information Engineering, Shenzhen University, Shenzhen, Guangdong, 518060, 
China 







2 


Cai Zhang et al. 


Quantum private comparison, as a subfield of quantum cryptography, has at¬ 
tracted more and more researchers. The aim of QPCs is to compare the partic¬ 
ipants’ private information without publicly revealing their respective private 
information. 

Since Yao [28] presented a protocol for the millionaires’ problem in which 
the participants try to determine which one is richer without revealing their ac¬ 
tual wealth, the protocols of private comparison have widely been investigated. 
Boudot et al. [55] proposed a protocol to decide whether two millionaires are 
equally rich or not. But Lo m showed that the equality function cannot be 
securely evaluated in a two-party scenario. Thus, some additional assumptions 
such as a semi-honest third party are required to achieve the goal of private 
comparison. 

Yang et al. [25] proposed the first quantum private comparison protocol 
in which the entanglement of Einstein-Podolsky-Rosen (EPR) pairs and the 
one-way hash function are employed. Chen et al. 126] presented an efficient 
protocol of equality using triplet states. Ref. EZi gave a more efficient quantum 
private comparison of equality protocol without the entanglement of EPR 
pairs. Liu et al. [5Tll321l33ll55| presented QPC protocols employing the triplet 
W states, x-type genuine four-particle entangled states and the Bell states. 
Huang et al. (35] designed a quantum private comparison of equality protocol 
with collective detection-noise channels. Liu et al. m employed single photons 
and collective detection to devise an efficient quantum private comparison 
protocol. Zhang et al. m proposed a quantum private comparison protocol 
based on an quantum search algorithm. Li et al. [38] presented an efficient 
protocol for equal information comparison based on four-particle entangled 
W state and Bell entangled states swapping. All the above protocol works 
for two-party who wish to compare their private information. Recently, some 
multi-user quantum private comparison protocols were presented. Chang et 
al. [35] gave a multi-user private comparison protocol using GHZ class states. 
Liu et al. [ID] presented a multi-party quantum private comparison protocol 
using d-dimensional basis states without entanglement swapping. 

All the above protocols include a third party who helps participants com¬ 
pute comparison results. Lin et al. m used EPR pairs and a one-way hash 
function to design a quantum private comparison of equality protocol without 
a third party that works for the two-party scenario. If the number of par¬ 
ticipants exceeds 2, can one find a protocol for quantum private comparison 
without an external third party who helps compute the comparison result? We 
find such a protocol for three-party quantum private comparison. The proto¬ 
col is based on genuinely maximally entangled six-qubit states (we name it 
BPB state). In our protocol, three participants can determine whether their 
private information are equal without the external third party, and meanwhile 
preserve the privacy of their inputs, respectively. Any unitary operations are 
not required to encode information due to the excellent properties of genuinely 
maximally entangled six-qubit states. Furthermore, the protocol employs one- 
step quantum transmission, hence it will not suffer Trojan horse attacks. Our 
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protocol is also proven to be secure against various attacks including outside 
and participant attacks. 

The rest of this paper is organized as follows. In Section 2, we analyze 
the structure of the genuinely maximally BPB state and show the excellent 
properties which are useful for designing our protocol. In Section 3, we pro¬ 
pose a protocol of quantum private comparison based on genuinely maximally 
BPB states. In Section 4, we analyze the correctness and the security of the 
presented protocol. Finally, we make a conclusion in Section 5. 


2 The genuinely maximally entangled six-qubit state 


Quantum entanglement, as a physical resource, plays a key role in many appli¬ 
cations such as quantum teleportation [45], quantum dense coding [45], quan¬ 
tum key distribution m, quantum secret sharing [45] and quantum secure 
direct communication mm- 

By using a numeric searching program, Borras et al. [461 found the gen¬ 
uinely maximally BPB state, which is 


—L[(|000000) + 1111111} + 1000011) + 1111100} 

v 32 

+ 1000101) + 1111010) + 1000110} + 1111001) 

+ 1001001 } + 1110110 ) + 1001111 } + 1110000 ) 

+ 1010001 ) + 1101110 } + 1010010 } + 1101101 ) 

+ 1011000 ) + 1100111 } + 1011101 } + 1100010 )) 

- (1010100) + 1101011} + 1010111} + 1101000) 

+ 1011011 ) + 1100100 } + 1001010 } + 1110101 ) 

+ 1001100) + 1110011} + 1011110} + 1100001))] 123456* 


( 1 ) 


We denote this six-qubit state by $6 qb - From the above formula, we can see 
that $6 qb includes 32 terms, each of which has even |0) and equal coefficient. 
To show the engtangled property of <^6 qb , we can rewrite it as 


v 6qb = -L[| 000 )| 7 i) +1 001 ) 172 ) + |010)|73> + | 011 )| 7 |} 

- 1100) | 7 5) — |101}| 7 g) + 1110) | 7 y) 

+ 1111) |T8 )] 123456 s (2) 

where {| 7 }}|j = 1, 2,..., 8} forms an orthogonal basis on Hilbert space C 2 0 
C 2 0 C 2 such that 

| 7 i) = ^(l°)l^ + ) +l42> = ^(10)1*-) -11)|*-)), 

hi) = -^(|0)|ff+) - |1)|<2> + )), | 7 ]) = ^(|0>|*-> + 11)1*")), 
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17s 1 } = -±=(|0}|<n + \1)\$~)), 17^) = -J=(|0)|<Z>+} - |1)|^ + )), 

I7t) = ^(|0>|*-) - Il>l^">), 17s 1 ) = ^(|0}|^ + } + l 1 )l^ + ))> 

and |<Z> ± ) and |lf ± ) are Bell states in the form of 

l* + > = ^(|00) + 111}) = -J=(| + +) + 1 - -}), 

l*-> = ^(|00) - 111}) = -J=(| + -) + I - +}), 

1^+) = -L(|01) + 1 10)) = -L(| + +} -1 - -}), 

\*-) = ^=( 101 ) - 110 }) = -h(| - +} - I + -}). 


(3) 

(4) 

(5) 

( 6 ) 
(7) 


Here, |+) = ^(|0) + |1)) and |—) = ^(|0) — |1)) are the eigenvectors of the 
Pauli operator ax ■ 

We can also rewrite 'pQqb as 

% qb = -±=[| + ++}| 7l 2 } + | + +-}| 7 2 ) + | + -+}| 73 2 } + | + — }| 7 2 } 

+ I - ++}l7l) + I - +-}l7e> + I - -+}l7?} 

+ I-) | 7 8 )] 123456 ? (8) 

where {| 7 2 }|j = 1,2, ...,8} also forms an orthogonal basis on Hilber space 
C 2 ® C 2 <S> C 2 such that 


| 7l 2 } = -±=(|+)|^ + ) + |-)l*")), l7a) = ^H+>l*"> + |-)l^ + )), 

| 7 2 } = ±{-\+)\$~) - 1-)|^ + )), | 74 2 } = -J=(|+}|<z> + ) - l-)l*-)), 

\lt) = j=(\+)\*~) + |-)l^ + }), |7e) = ^(l+}|^ + ) HI*")), 

| 7 2 } = 4(|+>|#+> + I-)!*")), hi) = 4(l+)l^-} - |-}l^ + }), 0) 


where l^} and |'? r± ) are Bell states as Eqs. (00 and |+} = ^=(|0) + |1)) and 
|—} = ^(|0) — |1}) are the eigenvectors of the Pauli operator ax- 

We will use Eq. © and Eq. © in our protocol to check whether the 
participant who distributes the state § q b is honest or not. 

Let us further investigate the properties of the state 


^6qh — ^(|^ + }l2|^ + )36|^ + }45 + |^ } 121 ^ )36|^ + )45 
+ W }l2|^ r+ )36|^ }45 + |^ + )l2|^ )36}45) 


(10) 
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= ^ ) 13 l^ )24|^ + )56 + |^ + )l3|^ r+ )24|^' + )56 


— I^ + ) 131^^)24)56 “ |tf / '')l3|^ + }24|tf / ' )s6) (U) 

= ^(1^ )l4|^ + )26|^^)35 + |^ + )l4|^ /r+ )26|^ /r+ }35 

+ W }l4}26|^ + }35 + \'d' + )u\& )26}35) (12) 

= 2 d^ + ) 15 l^ + ) 23 l^ + ) 46 + l^ _ )l51?^ + )23 1^ )46 
+ |^ + )l5|^ )23)46 + |^ ) 15)23|^ + )46) (13) 

= ^(1^ )l6|^ + )25|^^)34 + |^ + )l6 l^ - )25 1^)34 

+ |^ + )l6|^ + )25|^ + )34 + \& ) 16)25|^ + )34)- (14) 


From the above Eos. (11011 14ll . it is obvious to see that the other four qubits 
will collapse to the tensor product of two pairs of EPR when any two qubits 
of 'I'Qqb are measured with the Bell Basis {|^ + ), |<£~), |(F + ), I’F - )}. However, 
these two-split forms of Egqb are not suitable for our task. We should rewrite 
1 'pQqb as 

%qb = -j[|^ + )l2( |^ + )34 |^ + )65 + |^ )341^ >65 

+ |^ / ' + )34 |^ + )65 + |)341)65) 

+ |^~)l2(— |^ + )34 |^ _ }65 + |^~)34|^ + )65 

— |^ + )34 \& )65 + |^ )34|^ + )65) 

+ |tf / ' + )l2( |^ + )34 |S /r+ )65 + |^~)34|^~)65 

— |^ + )34 |^ + )65 — |)341)65) 

) 12( |^ + )34 |^ _ )65 + |^ _ )34|^ + )65 

+ |^ /,+ )34 |^ )65 — |^ _ )34|^ + )65)]- (15) 

Let us agree on the following encoding: 

|<2>+) -)• 00, \$~) -> 01, 

|(F+) -> 10, \W~) ->• 11. (16) 

We denote the encoding of x as Encod(x ) where x £ {|^ + ), |^ _ ), |>F + ), |<F _ )}. 
For example, Encod{\<!>~)) = 01. We can let Encod(x) = Encod(-x) because 
the measurement outcome of — x will be x with certainty if it is measured with 
Bell basis. Actually, we can say that x and — x are the same up to a global 
phase factor — 1. 

After the above encoding Eq. (fTCl) , the Eq. (fl5l) tells us that if we measure 
particles (1, 2) , particles (3, 4) and particles (6, 5) with Bell basis, respectively, 
then the responding measurement outcomes i?i 2 , Rm and i ?65 satisfy the 
following equation: 

Encod(R\ 2 ) © Encod(R?,i) © Encod(RQs) = 00. (17) 
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The Eos. (115111711 allow us to design a three-party quantum comparison protocol 
in which three participants can determine whether their private information 
are equal or not without the help of an external third party and keep their 
inputs secret, respectively. 


3 The three-party quantum private comparison protocol 

In our protocol, we assume that the classical and quantum channels are au¬ 
thenticated. Suppose that three participants Pi, P 2 and P 3 have private in¬ 
formation (secret bit strings) Mi, M 2 and M 3 , respectively. They wish to 
determine whether Mi = M 2 = M 3 or not and preserve the privacy of their 
information, respectively. The length of secret bit string is L. We assume that 
the participant Pi prepares the genuinely maximally BPB states $ 6 gb, then 
the process of the multi-party quantum private comparison protocol can be 
described as follows. 

(51) Pi first prepares (I"! 1 ] + S) (f ] denotes the ceiling function) genuinely 

maximally BPB states ■ Then he picks up the particles (3, 4) (parti¬ 
cles ( 6 , 5)) from each to form an ordered sequence S 34 (S^). After 

that Pi prepares d decoy particles, each of which is in one of the quantum 
states {|0), 11), |+), |—)}. He then randomly inserts the d decoy particles 
into the sequence 634 (Se 5 ) to form a new sequence S 34 (Sg 5 ). Note that 
anyone does not know the initial states and positions of the d decoy par¬ 
ticles except Pi. At last, Pi transmits SJ 4 ( Sq 5 ) to participant P 2 (P 3 ) 
and keeps the ordered sequence Si 2 of particles ( 1 , 2 ) from each i^gb in 
his lab. 

(52) Confirming that participant P 2 (P 3 ) has received all the particles S | 4 
(Sg 5 ) sent by Pi. Pi announces the positions and the bases of the decoy 
particles to P 2 (P 3 ). In the following, participant P 2 (P 3 ) measures the 
decoy particles with one of the two bases {| 0 ),| 1 )} and {|+),|—)} ac¬ 
cording to Pi’s announced information. And then P 2 (P 3 ) publishes his 
measurement outcomes. Later, Pi can determine the error rate accord¬ 
ing to the d decoy particles’ initial states. If the error rate exceeds the 
threshold, then this protocol will be aborted and repeat the step (SI). 
Otherwise, the protocol will go to the next step. 

(53) P 2 and P 3 collaborate to check whether Pi distributes the intended par¬ 
ticles to them. Namely, P 2 (P 3 ) should receive the ordered sequence S 34 
(S 65 ) of particles (3, 4) (particles ( 6 , 5)). First, P 2 (P 3 ) removes the decoy 
particles from S | 4 (S| 5 ) to get S 34 (S^s)- They then randomly choose 5 
genuinely maximally BPB states (f^b (we call them sample states) for 
checking and tell Pi the positions of the sample states. After that they 
ask Pi to measure the particles ( 1 , 2 ) in each sample state with one of the 
two bases {|0), 11)} and (|+), |—)} randomly. If Pi measures the particles 
(1, 2) with the basis {|0), 11)} ({|+}, |—)}), then P 2 measures the particle 
3 with the basis {|0), 11)} ({|+), |—)}), and P 2 and P 3 measure the parti¬ 
cles (4, 5, 6 ) with the basis {| 7 *)|j = 1,2,... ,8 } ({|t?)|j = 1,2,... ,8 }). 
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Finally, P 2 and P3 can determine the error rate of the correlation of their 
outcomes according to Eq. © and Eq. ©. If the error rate exceeds the 
threshold, then this protocol will be aborted and repeat the step (PI). 
Otherwise, the protocol will go to the next step. 

(54) By removing the particles of the sample states, Pi (P2, P3) measures 

particles (1, 2) (particles (3, 4) , particles ( 6 , 5)) of the ith (i = 

1,2,..., 1"^]) with the Bell basis. According to their measurement out¬ 
comes and the encoding arrangement Eq. (QH), Pi (P 2 , P 3 ) will get the 
key Ki (I\ 2 , A 3 ) that will be kept secret. For example, the possible mea¬ 
surement outcomes of the ith may be R\ 2 = (R\ A = |A+), 

Pg 5 = |^ - )), thus the ith two bits of K\ (A 2 , A 3 ) is 11 (10, 01). After 
that Pi (P 2 , P 3 ) computes Ci = Mi® A'i (C 2 = M 2 ffiA 2 , C 3 = M 3 ffiA' 3 ) 
(Here, ® denotes the addition module 2.). 

(55) P 2 (P 3 ) sends C 2 (C 3 ) to Pi, Pi then can determine whether M 2 = M 3 
or not. If M 2 7 ^ M 3 , Pi announces the result and the protocol finishes. 
Otherwise, Pi randomly computes C 13 = Ci © C 3 or Ci 2 = Ci ® C 2 . 
If Pi computes C 13 = C\ ® C 3 (Ci 2 = C\ ® C 2 ), he then sends C 13 
(Ci 2 ) to P 2 (P 3 ). Subsequently P 2 (P 3 ) can determine whether Mi = M 3 
(Mi = M 2 ) depending on the key K 2 (A 3 ) and C 13 (C\ 2 ). Finally, they 
can determine whether M\ = M 2 = M 3 or not and preserve the privacy 
of their information, respectively. 


4 Analysis of the presented protocol 

In this section, we will analyze the correctness and the security of our protocol. 


4.1 Correctness 

According to the Eq. (fI71) . we can find in the step (3U) that Jt 2 ® K 3 = 0. 
When Pi receives C 2 and C 3 from P 2 and P 3 , respectively, he could compute 


Ad ®C 2 ®C 3 = A'i © I< 2 © M 2 © A 3 0 M 3 
= A'i © A 2 © A 3 © M 2 © M 3 
= M 2 © M 3 . (18) 

Later, he can determine whether M 2 © M 3 = 0 depending on the Eq. (fl8l) . If 
he finds that M 2 © M 3 7^ 0, he can simply announce that Mi = M 2 = M 3 is 
false and the protocol finishes. Otherwise, the protocol will continue and P 2 
(P 3 ) can also determine whether Mi = M 3 (Mi = M2) or not in the step (f© 
using the similar method as that of Pi. Finally, the protocol could correctly 
determine Mi = A/ 2 = M 3 or not. 
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4.2 Security 

Compared with the quantum cryptography protocols such as quantum key dis¬ 
tribution (OKD) [T H7M8H91I50] . quantum secret sharing (QSS) [SlOSliniiniEUH] 
and quantum secure direct communication tQSDC") [^l fIUlHTlH^1113IJ14LfT5] . the 
security analysis of multi-party quantum private comparison protocol is more 
complicated. Because the attacks from all participants have to be considered 
in multi-party quantum private comparison protocols. Outside eavesdroppers 
have the desire to get the participants’ private inputs. In addition, some par¬ 
ticipants may do their utmost to derive other participants’ private secret in¬ 
formation. Therefore, multi-party quantum private comparison protocols must 
be secure against outside and participant attacks. 

4-2.1 Outside attacks 

Similar to the detection method for outside eavesdropping used in the BB84 
QKD protocol [T] , we employ the decoy particles to prevent the eavesdropping. 
It has been proven to be unconditionally secure by Ref. 05]. Any outside 
eavesdropping will be detected in the step (£0) , thus outside Eve’s all kinds of 
attacks, such as the intercept-resend attack, the measurement-resend attack, 
the entanglement-measurement attack, are useless in our protocol. We take 
the intercept-resend attack as an example here: suppose that the initial decoy 
particle state is |0), and Eve randomly measures it with one of the two bases 
{| 0 ), 11 >} and {|+),|—)}, and then she sends the fake particle prepared by 
herself according to the measurement outcomes to P 2 (P 3 ). Obviously, the 
probability of being detected during the step (321 is \ ■ When we use d decoy 
particles for eavesdropping detection, the probability of being detected will be 
1 — (|) d . We can see that if d is large enough, the probability of being detected 
will approach to 1. Therefore, Eve will be detected in the step (321- 

On the other hand, Eve may get the ciphertexts C 2 , C 3 , C 13 and C 12 that 
are one-time pad ciphertexts in the protocol. However, she cannot get the keys 
K\, K 2 or K 3 that are kept secret by the participants. Thus, she fails to derive 
the participants’ private inputs. 

Trojan horse attack EEDH21IM], such as the delay-photon Trojan horse at¬ 
tack and the invisible photon eavesdropping (IPE) Trojan horse attack, exists 
in two-way quantum communication protocols. Our protocol is congenitally 
free from these attacks because the presented protocol employs one-step quan¬ 
tum transmission. 

4-2.2 Participant attack: one of the participants wants to steal others’ inputs 

First, we can assume that P 2 wishes to steal the input of P\ (P 3 ) because the 
role of the participant P 3 is the same as the participant P 2 . 

In order to do that, he should find out Pi’s key A'i and P 3 s key K 3 . How¬ 
ever, he is unable to complete this task. From the Eq. 113 and the encoding 
arrangement Eq. dm), he can just have A'i © K 2 © K 3 = 0. P 2 is unable to 
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Table 1 The relations of the participants’ keys and their measurement outcomes. 



Pi 

P 2 

P 3 

Possible measurement 

outcomes 

Corresponding keys 

|^ + )l2 (|^ _ )l2) 
00 (01) 

|<£ + >34 (|# + >34) 
00 (00) 

|^+>65 (l^")65) 

00 (01) 

Possible measurement 

outcomes 

Corresponding keys 

|^ + )l2 (|^“)l2) 
00 (01) 

|^“>34 (|^ _ >34) 

01 (01) 

|^ _ )65 (l^ + >65) 

01 (00) 

Possible measurement 

outcomes 

Corresponding keys 

|^ + )l2 (|^“)l2) 
00 (01) 

|^+>34 (|f + )34) 
10 (10) 

|^ + )65 (l>^ _ >65) 

10 (11) 

Possible measurement 

outcomes 

Corresponding keys 

|^ + )l2 (|^“)l2) 
00 (01) 

|f">34 (|^“>34) 

11 HI) 

|^“>65 (l^ + >65) 

11 ( 10 ) 

Possible measurement 

outcomes 

Corresponding keys 

|tf'+>12 (|f' - >12) 
10 (11) 

|^+>34 (|^ + >34) 

00 (00) 

|^ + >65 (|^ _ >65) 

10 (11) 

Possible measurement 

outcomes 

Corresponding keys 

\'P+)l2 (l , f' _ >12) 
10 (11) 

\<p-) 3 4 (|<£">34) 
01 (01) 

l^“>65 (l^+>65) 

11 (10) 

Possible measurement 

outcomes 

Corresponding keys 

W + )l2 (l , f' _ >12) 

10 (11) 

l^+>34 (l^ + >34) 
10 (10) 

l^ + >65 (l^“>65) 

00 (01) 

Possible measurement 

outcomes 

Corresponding keys 

|!f + )l2 (1^)12) 

10 (11) 

|^ r_ >34 (|'J ,_ >34) 
11 (11) 

|<£ _ >65 (|^ + >65) 

01 (00) 


exactly figure out the values of I\\ and K 3 . In the step (33, P -2 may get C 13 
(C 12 ) that’s the ciphertext of Mi © M 3 (Mi © M 2 ) encrypted by K 2 (A 3 ). 
But he cannot obtain C 13 and C 12 at the same time in our protocol. If P 2 
gets C 12 , he could compute C 12 © C 2 = Ci = A'i © Mi. He could also get C 3 
and C 13 , computing C 3 © C 13 = K 3 © M 3 © Ki © Mi © K 3 © M 3 = Ki © Mi 
which is the ciphertext of Mi encrypted by Ki. Obviously, he cannot have 
the Pi’s private input Mi because he does not know the exact value of K\. 
P 2 also fails to get P 3 ’s private input M 3 because he cannot get P 3 s key I\ 3 . 
Therefore, P 2 couldn’t have the private inputs of Pi and P 3 . We take the two 
bits keys as an example so as to see the relations of the participants’ keys 
and their measurement outcomes. The details see Table [T] From this table, we 
know that P 2 cannot definitely determine the keys of Pi and P 3 depending on 
his own key. 

Second, we will show that our protocol is still secure if Pi wants to steal 
others’ inputs. In the proposed protocol, the participant Pi who prepares the 
state 'pQqb is more powerful than P 2 and P3. He may prepare some particu- 






10 


Cai Zhang et al. 


lar fake particles, sending them to P 2 and P 3 , respectively. And then he can 
determine the keys of P 2 and P 3 with certainty. Hence he could get the pri¬ 
vate inputs of P 2 and P 3 . For instance, Pi can send particles in the ordered 
sequence in Bell state |>F - ) (|*F + )) to P 2 (P 3 ) if he wishes to decide some two 
bits of P 2 ’s (P 3 ’s) key to be 11 (10). He could also prepare the real state 'Pq q b, 
but then sends the particular particles to P -2 (P 3 ) according to Eas. lllOHlll) . He 
can finally steal the key of P 2 (P 3 ) depending on the relation of their measure¬ 
ment outcomes, obtaining their private inputs. Unfortunately, these attacks 
will be detected in the step (£© of our protocol if S is large enough. The gen¬ 
eral attack of Pl can be described by a unitary operation: Ua performed on 
qubits, including the state Pe q b and the probe state initialized as |0 )a before 
Pi sends the particles to P 2 and P 3 . We can prove that the final state of \pQ q b 
would not be entangled with Pi’s probe state, which implies P 4 cannot get 
any information about exact measurement outcomes of P 2 and P 3 through his 
probe if there is no error to occur. Thus he could not get the keys of P 2 and 

P 3 - 

The most general operation Pi can do is to entangle the state P& q b with 
the probe state initialized as jO)^, which can be written as 


UA'pQqblti)A = -j-[|^ + )l2( |^ + )34 

+ |^ + ) 3 4 

+ |# - )l2(- \& + ) 3 4, 

- |^ + ) 3 4 
+ |f r+ )l 2 ( \& + ) 3 4 

- |^ + ) 3 4 
+ \P~)l 2 (- |<P f }34 

+ |^ + }34 


|^ + )65|Ai) + |^ >34 )&h\A 2 ) 
\'P + )6b\A 3 ) + W ) 341 }65 |-A 4 )) 

1 ^ )651^4.5> | + |^~)34|^ + )65|Ae) 

1^ )651^4.7> + W ) 341 ) 651 Ag ) ) 

|^ + )651^4.9) + )341^ _ )65 | A 10 ) 

|^ + )65|An) — \P )34 )65|Ai2)) 

I)65 | A 13 ) + |tP ) 34 1)65 | A 14 ) 

1 ^ )65 | A 15 ) — |S /r ^)34|^ + )65|Ai6))], 


(19) 


where | Ai) (i = 1,2,, 16) are some unnormalized states in Pi’s probe space. 
We will prove that that the final state of pQ q b would not be entangled with 
Pi’s probe state if he can escape the detection in the step (33) of our protocol. 

On one hand, if P 4 measures the particles (1, 2) with the basis {10), 11)}, 
then P 2 measures the particle 3 with the basis {|0), 11)}, and P 2 and P 3 measure 
the particles (4, 5, 6 ) with the basis {| 7 j)|j = 1,2,... , 8 }. Then, the state in 
Eq. (fTTil) can be rewritten as follows: 


-J={|000)[|7i 1 )(|Ai) + |A 3 ) + |A 6 ) + |A 8 » + | 7 i>(l^2> - \M) - |A 5 ) +1 a 7 )) 

+|76 1 )(I^i) - X 3 > + |A 6 ) - |A 8 )) + |7^)(|A 2 ) + \M) ~\As) - \A 7 ))] 

+|001)[|7 2 1 )(|A 2 ) + |A 4 ) + |A 5 > + I A 7 )) + KXI^i) + 14.) - |A 6 ) - |A 8 )) 

-H75>(l^4> - \A 2 ) - \A 5 ) + I Ar)) + KXXi) + |A 3 ) - |A 6 ) - |A 8 »] 

+ |010)[|73)(|Aio) + |Ai 2 ) + |Ai 3 ) + |Ai 5 )) + I 72 XIA 9 ) - |An) - |A 44 ) + |A 46 )) 
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+I 75 XD 9 ) + |^4ii) - |A i4 ) - |Ai 6 }) + I'T'g)(l^4io) - ^ 12 } + |A i3 ) - |Ai 5 ))] 

+|0H)[|74)(|49) + l-4.ii) + |A i4 ) + |-4i6)) + |7i)(|Ai 2 ) - |Ai 0 ) + |A i3 ) - |-4 i 5 )) 

+|76)(|4io) + |-4i 2 ) - |-4 13 ) - |4i 5 )) + |-7r)(|-4n) - |A 9 ) - |A i4 ) + |Ai 6 ))] 

— 1100) [I 75 ) (|^4 9 > + |4n) + |-4 14 ) + |Ai 6 )) + I'tI ) (|-4 9 ) — |An) + |Ai 4 ) — |-4 16 )) 
+|73)(|4io) + |-4i 2 ) - |-4 13 ) - |4i 5 )) + |7s)(|4io} - |-4 12 ) - |A i3 ) + |Ai 5 ))] 

^l 101 )[|76)(|4io) + |-4 i 2 ) + |-4 13 ) + |4i 5 )) + |7i)(|4i 2 ) - |-4 10 > - |A i3 ) + |Ai 5 )) 

+I 74 ) (1^9) + l-4n) — |-4 14 ) — |-4 i 6 }) + |7 7 )(|An) — |Ag) + |-4 14 ) — |-4 16 ))] 
+|110)[|7 7 1 }(|4 2 ) + |A 4 ) + |A 5 > + |A r )) + | 7 i)(|Ai) + |A 3 ) - |A 6 ) - |A 8 )) 

+|74 1 }(|4 2 ) - |A 4 ) + |A 5 ) - |A 7 )) + |7e)(l-4i.) - |A 3 ) - |A 6 ) + |A 8 »] 

+|H1)[|7s 1 }(|4 1 ) + |A 3 ) + |A 6 ) + |A 8 )) + | 7 !>(|4 2 > + |A 4 ) - |A 5 ) - |A 7 )) 

+ I 73 ) ( 1 ^ 43 ) — |4i) — |A 6 ) + |A 8 )) + I 75 ) (|-4 4 ) — |A 2 ) + |A 5 ) — | A 7 } )]} 123456-4 • 

( 20 ) 

According to Eq. (121), if Pi introduces no error, the following conditions should 
be satisfied: 


|Ai) = |A 3 ) = |A 6 ) = |A 8 ), 

|a 2 ) = |A 4 ) = |A 5 ) = |A 7 ), 

|A 9 ) = |An) = |A 44 ) = |A 46 ), 

|Aio) = |A 42 ) = |A 43 ) = |A 5 ). (21) 

On the other hand, if P 4 measures the particles (1, 2) with the basis {|+}, |—)}, 
then P 2 measures the particle 3 with the basis (|+),|—)}, and P 2 and P 3 
measure the particles (4, 5, 6 ) with the basis {| 7 ?)|j = 1, 2,. .., 8}. Then, the 
state in Eq. 03 can be rewritten as follows: 


V8 {l 

+ ++)[|7i 2 )(|A 2 ) 

+ 

A 3 ) + 

A 13 

) + |4i 

6 )) + l74 2 )(l^i) 

-\M) 

+ IA 14 ) 

- |Ai S )) 

+|76)(|4 3 ) 


A 2 ) + 

A 13 ) — A] 

6 )) + l7r 2 )(|4i) 

+ |4 4 ) 

- |a 14 ) 

- |4i 5 ))] 

+| 

+ +-)[|7 2 2 )(|4i) 

+ 

a 4 ) + 

IA 14 

) + |4i 

5)) + |7 3 2 )(|4 3 ) 

-\M) 

- |a 13 ) 

+ |4l6)) 


+l7f)(|4i) 


a 4 ) — 

\Ai4 

) + |4i 

5)) + |7l)(|42) 

+ |4 3 ) 

- |a 13 ) 

- |4l 5 ))] 

+| 

+ -+)[|7 3 2 )(|4 5 ) 

+ 

a 8 ) + 

A 10 

) + |4i 

i)) + |7 2 2 )(|A 6 ) 

-|4 7 ) 

+ 4g) - 

- |4l2)) 


+l7l)(|4 6 ) 

+ 

A 7 ) — 

|4 9 ) 

— | A 12 

)) + l7l)(|A 8 ) - 

■ IA 5 ) + |Aio) - 

-|4n))] 

+| 

+ — )[|7 4 2 )(|4 6 ) 

+ 

a 7 ) + 

|4 9 ) 

+ 1 A 12 

)) + |7i 2 )(|A 8 )- 

- |4 5 ) - 

- A 10 ) + An)) 


+l7l)(|4 5 ) 

+ 

a 8 ) - 

A 10 

>-|4i 

i)) + |7 7 2 )(|4 6 ) 

~\M) 

- Ag) + A 12 ))] 

+| 

-++)[|7f)(|A 6 ) 

+ 

A 7 ) + 

|4 9 ) 

+ | A 12 

» + l72 2 >(|4 6 >- 

-14 7 > - 

- | Ag) + 

|4l2)) 


+|7 3 2 )(|4 5 ) 

+ 

a 8 ) - 

A 10 

)-|4i 

i)) + l7l)(|4 8 ) 

-|4s) 

- |Aio) 

+ |4n))] 

+| 

- +-)[|7 6 2 )(|4 5 ) 

+ 

a 8 ) + 

A 10 

) + |4i 

i)) + |7i 2 )(|A 8 ) 

- |4s) 

+ A 10 ) 

- |4n)) 


+|7 4 2 )(|4 6 ) 

+ 

a 7 ) — 

|4 9 ) 

— A 1S 

)) + 7 2 )( A 6 ) - 

- | A 7 ) + | Ag) — 

|4l2))] 

+| 

- -+)[|7 2 )(|4i) 

+ 

A 4 ) + 

IA 14 

) + |4i 

5 )) + |7i 2 )(|A 2 ) 

+ ^ 3 ) 

- |Ai 3 ) 

- |Aie)) 


+|7 4 2 )(|4i) 


A 4 )- 

IA 14 

) + |4i 

5)) + |7l)(|4 3 ) 

-|4 2 ) 

+ A i3 ) 

- |4i 6 ))] 
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+1 - — >[|78 2 >(l^2> + |a 3 ) + \A 13 ) + \A 16 )) + |7 2 2 )(|A 1 ) + |A 4 > - I A 14 ) - \A 15 )) 

+ |7 3 )(|A 3 ) — |A 2 ) + 1 ^ 13 } — |>W) + hDd^l) — 1 ^ 4 ) + 1 ^ 14 } — |^15))]}l23456 J 4- 

( 22 ) 

According to Eq. Q, if Pi introduces no error, the following conditions should 
be satisfied: 


|Ai) = |Ai) = IA14) = |Ai 5 ), 

|A 2 ) = |A 3 ) = |Ai 3 ) = | A 15 ), 

IA5) = |A 8 ) = |Ai 0 ) = |An), 

I Ag) = |A 7 ) = |A 9 ) = |Ai 2 ). (23) 

We can derive from Eq. (1211) and Eq. C3l) that |Ai) = |A 2 ) = ... = |Ai 6 ), 
which means that the state 'pQqb and the prob state prepared by P\ are entirely 
not entangled. Thus the subsequent measurement outcome of the prob state 
tells Pi nothing. 

Pi may use the similar attack as _P 2 to derive the inputs of P 2 and P 3 in 
accordance with the cipertexts C 2 and C 3 that are M 2 and M 3 encoded with 
I \ 2 and K 3 , respectively. However, according to the Eq. m and the encoding 
arrangement Eq. (ED. he can have A'i © K 2 © K 3 = 0 but the keys I \ 2 and K 3 
and therefore is unable to steal M 2 and M 3 offered by P 2 and P 3 , respectively. 
So the protocol remains secure against this attack. 

In the step (3SD of our protocol, Pi first determines whether M 2 = M 3 
using his own key K 1 , P 2 (P 3 ) then determines if Mi = M 3 (Mi = M 2 ) or not 
based on his key K 2 (/v 3 ) and at last they can get the comparison result. In 
fact, the order in which one participant decides whether or not the other two 
participants’ private inputs are equal is not important because their private 
inputs are encrypted by their keys that are kept secret. 

Unfortunately, any two participants can collude with each other to derive 
the third one’s key according to J\iffiA 2 ©A 3 = 0 , obtaining the corresponding 
private input. So it would be interesting to design multi-party quantum private 
comparison protocols that are still secure against such an attack. 

4-2.3 Security analysis over lossy and noise channel 

In the above analysis, the quantum channels are assumed to be under the ideal 
condition (i.e. noiseless and lossless). But quantum channels are usually lossy 
and noisy in the real world. In this section, we show that our protocol remains 
secure in lossy and noisy quantum channels. The eavesdropper, Eve, is assumed 
to be powerful enough to establish an ideal channel with any participant. We 
discuss the lossy and noisy quantum channels in case as follows. 

Case 1. Lossy quantum channel 

In such a quantum channel, Eve may intercepts particles sent from Pi to 
P 2 and P 3 . She then keeps some of them and transmits the other particles to 
P 2 and P 3 through an ideal channel. If the intercepted particles are not decoy 
particles, she is able to perform measurements on the related particles with Bell 
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basis. The measurement results will lead to the leakage of the some key bits for 
Pi, she will finally get some information of Pi’s private input. Fortunately, our 
protocol remains secure against such a attack. In the Step 2 of our protocol, P 2 
(P 3 ) informs P\ which particles have been received and which are lost during 
the transmission. P\ and P 2 (P 3 ) only employ the received particles to make 
a public discussion and finish equality comparison. The intercepted particles 
are useless and Eve will fail to extract any information about Pi’s key that is 
used to encrypt his private input. 

Case 2. Noisy quantum channel 

Eve can intercept the particles sent from Pi to P 2 (P 3 ), performing intercept- 
resend attack or entangle-measure attack, forwarding these tampered particles 
to P 2 (P 3 ) through an idea channel established by herself. In this situation, 
Eve tries her best to cover up the tampering of particles as the noise existed 
on the quantum channel between Pi and P 2 (P 3 ). We have learned that these 
attacks will be caught if the eavesdropper detection rate of our protocol is 
smaller than the quantum bit error rate of noise (QBER). In accordance with 
[54l(55l[56] . the QBER is roughly between 2% and 8.9% depending on the dif¬ 
ferent channel situations (e.g., distance, etc.). Fortunately, the detection rate 
for decoy particle in our protocol is 25% that is greater than the error rate 
of the quantum channel. Therefore, our protocol is also secure in the noisy 
quantum channel. 

Up until now, we have completed the analysis of the correctness and the 
security of our protocol. 

Note that if Lin et al.’s protocol [41] is used for three participants’ private 
comparison, it needs run twice in the worst case. But our protocol needs run 
only once even in the worst case. For Chang et al.’s protocol [35], in the case of 
the number of the participants is 3, our protocol needs more 6(5 particles than 
their protocol do and our protocol will suffer collusion attack as mentioned 
in the previous security analysis. This is the disadvantages of our protocol! 
However, such disadvantages happen because of the lack of an external third 
party. The more 65 particles serves as participant attack detection, because 
the initial quantum states are prepared by Pi. We need to check if he is honest. 
If we include the external third party who is assumed to be semi-honest and 
prepares the initial quantum state, these defects will vanish. But it will require 
more various quantum states and different quantum operations. Chang et al.’s 
protocol may not be able to finish the private task if it lacks the senri-honest 
third party. In practice, resorting to an external third party for help in quan¬ 
tum private comparison may unexpectedly result in some private information 
leakage and this help is usually not free. In this sense, designing quantum 
private comparison protocols without an external third party is necessary. 


5 Conclusions 

We present a new three-party quantum private comparison protocol based on 
genuinely maximally entangled six-qubit states. Three participants can deter- 
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mine whether their private information are equal without the assistance of an 
external third party and in the meantime keep their inputs secret, respectively. 
The proposed protocol does not require any unitary operations to encode infor¬ 
mation for the sake of the excellent properties of genuinely maximally entan¬ 
gled six-qubit states. Because the proposed protocol utilizes one-step quantum 
transmission, it can be prevented from Trojan horse attacks. Finally, we also 
analyze the correctness and security of our protocol. 
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